skills.rest
n4igme
n4igmeCOMMUNITY
Explore all skills by this author →
Website𝕏@nevrectlGitHub

security-arsenal

Assemble security payloads for XSS, SSRF, SQLi, and related vulnerabilities.

Updated Jun 23, 2024
Search Tags:#security#xss#sqli#payloads#ssrf#xxe#mfa-bypass
One-click install
npx skills add https://github.com/n4igme/randscript --skill security-arsenal-n4igme
Or copy as Structured Prompt for Agent▼
Please help me install this Agent Skill.
Skill: security-arsenal
Source: https://github.com/n4igme/randscript/tree/main/llm/skills/claude-hunter/skills/security-arsenal
Command: npx skills add https://github.com/n4igme/randscript --skill security-arsenal-n4igme

SYSTEM DOCUMENTATION & REQUIREMENTS

What problem does it solve?

Provides a comprehensive library of security payloads, bypass patterns, wordlists, and chain considerations to aid security testers in identifying and validating vulnerabilities like XSS, SSRF, SQLi, XXE, and more, while guiding safe submission practices.

Core Features & Use Cases

  • Payload libraries for XSS, SSRF, SQLi, XXE, NoSQLi, SSTI, IDOR, path traversal, HTTP smuggling, WebSocket, MFA bypass, and submission rules.
  • Pattern names, wordlists, and submission guidance to help testers decide if a finding is submittable and how to chain findings safely.
  • Use Case: When assessing a target, load the relevant payload sections to test for data exfil, bypasses, and chainable exploits, while consulting submission rules to determine reportability.

Quick Start

Type a specific payload category into the assistant to retrieve relevant payloads for a given vulnerability scenario.

Frequently Asked Questions about security-arsenal

High-intent search queries and answers about installing and using this skill.

FAQPage Schema
Where can I find security payloads for testing web app vulnerabilities like XSS and SSRF?▼

The library enforces safety validation using an 'Always Rejected' and 'Conditionally Valid — Requires Chain' framework, applying a reduction strategy for high-risk payloads to avoid unnecessary risk during testing.

How do I safely chain security findings like SQLi or XXE to demonstrate impact?▼

The library provides clear guidance on chaining findings safely. It includes pattern names, wordlists, and submission rules that help testers determine if a vulnerability like SQLi or XXE is reportable and how to validate it without causing damage.

Does this payload library include bypass patterns for MFA and WebSocket endpoints?▼

Yes, the payload library includes specific bypass patterns for MFA and WebSocket endpoints. It covers diverse test scenarios across web apps and APIs, providing targeted payloads and submission rules for these security testing targets.

What submission rules apply when validating HTTP smuggling or SSTI vulnerabilities?▼

The library includes submission rules that help testers determine if an HTTP smuggling or SSTI finding is submittable. It applies an 'Always Rejected' framework for unsafe tests and a reduction strategy for high-risk payloads to guide safe submission practices.

Are there security testing limitations for high-risk payloads like NoSQLi or IDOR?▼

Yes, limitations apply to high-risk payloads like NoSQLi or IDOR through a reduction strategy. The library enforces safety validation by categorizing payloads into 'Always Rejected' or 'Conditionally Valid — Requires Chain' frameworks to prevent unnecessary risk.

Related Skills

Explore More Software Engineering Skills→
xalgordxalgord
846

rce

Automate RCE testing across command injection, deserialization, template injection, and code evaluation paths.

Community
Advanced
mindfortaimindfortai
16

finding-review

Triage cybersecurity findings for validity, exploitability, impact, and evidence quality.

Official
Advanced
cmndcntrlcybercmndcntrlcyber
3

hunt-http-smuggling

Detect HTTP request smuggling vulnerabilities by analyzing header parsing inconsistencies.

Community
Advanced
langbyyilangbyyi
96

http-parameter-pollution

Identify HTTP parameter pollution vulnerabilities from inconsistent duplicate parameter parsing.

Community
Intermediate